On Tue, Sep 15, 2026 at 08:45:23PM +1200, Eva Crystal wrote: > Thanks Ludwig - I hadn't referenced your series in my cover letter, > and I should have. > > v8 4/8 does close the configuration side: fit_config_verify_required_keys() > gains FIT_REQUIRE_CONFIG_SIGS and fails closed when no keys with > required='conf' are present. > > The case I reported is the other gate. fit_image_verify_required_sigs() > looks up the /signature node in the control DTB and, when it is missing, > sets *no_sigsp = 1 and returns 0 with only a debug() message. Every caller > then treats the image as not requiring signatures, so nothing downstream > can fail. As far as I can see from your v8 hunks that path is unchanged. > > Two things follow: > > - I picked FIT_REQUIRE_CONFIG_SIGS for my Kconfig symbol, which collides > with yours. I'll rename mine to FIT_REQUIRE_IMAGE_SIGS (plus the SPL > variant), default off, since the two gates have different blast radius. > > - Jonas raised on 4/8 that Rockchip uses FIT_SIGNATURE for image integrity > only, not signed configurations. An image-side required-signature gate > hits that setup directly, which is the other reason to keep it a separate > symbol that is off by default. > > I'll rebase on top of your series and resend once v8 lands, rather than > adding a patch to a series that already carries review tags. > > Tom, shout if you'd rather see it folded in instead.
Since Ludwig is already working in this area, I'd like his thoughts on the issue / solution, and if it would make more sense to fold this in to his series or not. Thanks. > > Eva > > On Tue, Sep 15, 2026 at 8:23 PM Ludwig Nussel <[email protected]> > wrote: > > > > On 9/14/26 19:34, Tom Rini wrote: > > > On Tue, Sep 08, 2026 at 09:27:03AM +1200, Eva Crystal wrote: > > >> > > >> Reporting a fail-open condition in FIT signature enforcement. > > > [...] > > > Hello. Yes, please follow > > > https://docs.u-boot-project.org/en/latest/develop/sending_patches.html > > > and provide a fix and test for this issue, thanks! > > > > https://patchwork.ozlabs.org/project/uboot/patch/20260813080943.v8.4.6d1d5d14140677a76a7cd7bb99a9088d8c8f480c@changeid/ > > > > cu > > Ludwig > > > > -- > > Ludwig Nussel > > Siemens AG > > www.siemens.com > > -- Tom
signature.asc
Description: PGP signature
